PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-18007 Google CVE debrief

CVE-2026-18007 is an inappropriate implementation in Google Chrome's Input feature on Android, allowing remote attackers to perform UI spoofing via a crafted HTML page. This issue, tracked as Chromium security severity: Low, affects Google Chrome versions prior to 151.0.7922.72. The vulnerability has a CVSS score of 4.3 and a severity of MEDIUM. Defenders responsible for Google Chrome deployments on Android should assess exposure and verify version 151.0.7922.72 or later is deployed. The CVE record and NVD entry provide details on the vulnerability.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-30
Original CVE updated
2026-10-23
Advisory published
2026-07-30
Advisory updated
2026-10-23

Who should care

Defenders responsible for Google Chrome deployments on Android should assess exposure and verify version 151.0.7922.72 or later is deployed.

Why it matters

CVE-2026-18007 is a UI spoofing vulnerability in Google Chrome on Android, requiring verification of version 151.0.7922.72 or later to prevent attacks. Defenders responsible for Google Chrome deployments should assess exposure.

  • Defenders must verify Android deployments of Google Chrome for version 151.0.7922.72 or later to prevent UI spoofing attacks.
  • Successful exploitation could lead to UI spoofing, allowing attackers to deceive users.

Technical summary

The vulnerability is caused by an inappropriate implementation in Google Chrome's Input feature on Android. This allows remote attackers to perform UI spoofing via a crafted HTML page. The issue has a CVSS score of 4.3 and a severity of MEDIUM. The vulnerability affects Google Chrome versions prior to 151.0.7922.72 on Android. Defenders should prioritize verifying Android deployments of Google Chrome for version 151.0.7922.72 or later, and assess exposure to UI spoofing attacks.

Defensive priority

Defenders should prioritize verifying Android deployments of Google Chrome for version 151.0.7922.72 or later, and assess exposure to UI spoofing attacks.

Recommended defensive actions

  • Verify Google Chrome for Android version 151.0.7922.72 or later is deployed.
  • Assess exposure to crafted HTML pages.
  • Monitor for UI spoofing attempts.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 4.3 and severity of MEDIUM. Chromium security severity is listed as Low.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-18007 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-18007

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-18007 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-18007

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.